AI generated image depicting leader making the early call.

S³ Brief November 2026

November 09, 2026•9 min read

Offline on Purpose

Australia's cyber agency now advocates for system security above system availability. Continuity plans, service agreements, and reliability standards across many sectors were based on the opposite premise. For boards and executives accountable for essential services or critical infrastructure, three questions follow: who makes the call before anyone can prove a system is compromised, how far is reasonable to step back, and who wears the cost.

Signal Scan

Australia: In October the Government released the Australian Signals Directorate's (ASD) Annual Cyber Threat Report 2025-26 and asked all entities to "prioritise security over service availability". The Head of the Australian Cyber Security Centre, Stephanie Crowe, gave the reason: the rising rate at which artificial intelligence (AI) models find vulnerabilities.

This request followed a live example. Five days earlier, two critical flaws were disclosed in PHP, the programming language behind a large share of the world's websites. The researchers who found them said frontier AI models had lowered the barrier to exploiting flaws that had sat in the code for decades. ASD's Director-General, Abigail Bradshaw, told the Australian Broadcasting Corporation (ABC) what followed: websites "having to be taken down in order to be secured".

APAC: Singapore's Cyber Security Agency advised organisations to patch internet-facing systems first and check for PHP hidden in third-party components. A senior minister told Parliament there was no evidence of exploitation.

New Zealand's National Cyber Security Centre (NCSC) told organisations unable to patch to consider disabling public-facing web services.

On 6 November, after a wave of breaches across companies and agencies, Japan announced a ¥10 billion (nearly A$92 million) emergency cyber package.

Global: European governments took their own services down. The Dutch NCSC took its website offline as a precaution. Finland took government network services offline, France put Interior Ministry websites into preventive maintenance, and Denmark's municipal IT body shut the national school communication platform. In the UK, 32 government services were unavailable, "largely" as a precaution. The US Cybersecurity and Infrastructure Security Agency (CISA) said systems that could not be promptly updated should be taken offline.

McKinsey frames the gap these decisions are trying to close: attackers move at machine speed, while organisations decide at committee speed. It cites third-party tracker estimating that mean time to exploit critical vulnerabilities has fallen from about 23 days in 2025 to around 20 hours in 2026.

Shock Watch

The attack lands on the process: On 2 November, three of France's national blood service cold-storage sites had temperature and defrost thresholds raised to extreme levels. Supermarket fridges across at least 10 European countries were hit the same day. At the blood service, monitoring caught the change before any products were damaged.

In October, French supermarket fridges were heated to 50 °C causing fires. One chain estimated losses in the tens of millions of euros in a single day. Reporting points to refrigeration controls left reachable over the internet so maintenance firms could adjust them remotely.

The equipment stayed online and worked exactly as instructed, just to settings adjusted by bad actors.

The right call can look excessive the next day: On 22 October the Dutch NCSC told organisations not to wait for signs of exploitation and to keep potentially vulnerable systems offline. A day later, it revised the risk of large-scale exploitation down. A board that judges the call negatively in hindsight will teach its executives to wait longer to act.

Some duties are fixed in law: The Australian Communications and Media Authority (ACMA) alleges Optus Mobile committed 1,005 contraventions of emergency call rules during a September 2025 outage, each carrying a maximum penalty of A$250,000. For some services, availability is written into law. ASD's direction sits alongside those obligations, and some organisations will carry both.

Silence Does Damage: ASD's guidance cites this 2021 case. In May of that year Colonial Pipeline proactively took systems offline after a ransomware attack, halting the pipeline that carries about 45% of the fuel consumed on the US East Coast. Within days, more than 1,000 service stations in the Southeast had run dry, mostly from panic buying.

The shutdown was defensible. Where customers fill a gap in information with their own conclusions, their reaction become the event.

Sensemaking

A concern I frequently hear from leaders relates to making a big call too early. Availability has long been a primary measure of success. Taking a service down may be perceived as failure, even when it's ultimately proven to be the right call.

Paramedicine taught me to make the call early. When a patient needed treatment beyond my skill set, I called for it as soon as I recognised the gap in what I could offer. I kept working with what I had and got those with the higher-order skills on the move, in case there was no improvement. Waiting meant a patient might deteriorate, and support would arrive to a poorer baseline. Not an acceptable outcome. It reinforced that it was better to make the call early and bear the cost of over-servicing initially. Standing a back-up crew down was less impactful than letting someone's health go further south.

Under Prudential Standard CPS 230, the boards of entities regulated by the Australian Prudential Regulation Authority (APRA) approve how long each critical operation can be disrupted, how much data can be lost, and what service must be kept during interruption. Critical infrastructure operators record their positions in their Critical Infrastructure Risk Management Program (CIRMP). Those tolerances were set when availability was the default.

ASD's position now sits alongside that default, creating a standing tension. Compliance obligations are almost certain to compound, and some are likely to conflict. What is without question is the need to revisit what has been approved locally.

Prioritising security rarely means switching everything off. ASD's CI Fortify guidance sets out a staged approach: cut remote access first, then step back connection by connection towards full isolation, with the trigger for each step agreed in advance. Each move shifts risk and workload: manual workarounds, systems falling outside of patch, links to be partners being broken. These too, must be managed.

But how will we know? Through a trigger agreed in advance and communicated widely, so people know what they are looking for and have a clear pathway to escalate when it's observed. An early call mobilises people, getting eyes and hands on so assessment can occur and processes rapidly deployed. The sooner the threat is validated or dismissed, the sooner everyone can move back to business as usual.

There needs to be a tolerance for being wrong. Some precautionary calls will prove more extensive than necessary, as the Dutch revision showed. A threat ruled out is evidence of a process working and needs to be communicated as such.

From the boardroom to operations: Three settings must be in place to operationalise this shift.

Authority: who can make the call to step a system or service back before compromise is confirmed. McKinsey describes organisations that give one decisionmaker delegated authority, pre-authorised play books, and reporting to the board after the action.

Agreement: what has been agreed in advance, for example with regulators, insurers, customers, and suppliers. Two stakeholders may pull in opposite directions over the one decision. It's cheaper to surface and resolve that friction before it's tested.

Communication: what stakeholders hear in the first hour. Know where the exposure sits: in the gap between the decision, the consequences people feel, and the explanation they hear. Don't leave it open to interpretation.

Interdependencies

Every precautionary step back has a price, and that price isn't borne alone.

Cover for a voluntary shutdown is typically tied to an attack in progress, so a precautionary slowdown or shutdown might fall outside the organisation's insurance policy. Marks & Spencer's 46 day pause in online orders in 2025 carried an expected cost of about £300 million (A $582 million) in operating profit.

Customers lose access first and pay for it in convenience. Queues and empty pumps were the experience on the US East Coast in 2021.

After Jaguar Land Rover proactively shut down its systems in 2025, production paused for nearly a month and the UK Government guaranteed a £1.5 billion (A$3 billion) loan to support its supply chain.

Those who depend on an affected system inherit a decision they did not make. David Jones' suppliers are living a version of this now. The retailer entered voluntary administration on 5 November after rent talks with its largest landlord failed, and suppliers are now trying to recover stock and write off unpaid invoices. One described the retailer's communication as "almost non-existent".

Questions for Leaders

What triggers each step back on critical services, from tighter access control to full isolation, and who has the authority to action each step?
How many precautionary outages can an organisation weather in a year, and who wears the cost of each?
When a service is diminished or removed, who is authorised to share what, when, and to whom?

What Matters Next

30 days: Review for suppliers that can reach operational controls remotely, get assurances on their security controls, and confirm what you can verify directly, but instrument or by hand. Then, run a scenario: a credible warning, no confirmed compromise. Monitor assessment, decision and action and address anything that doesn't meet expectation.

90 days: Review enterprise risk and tolerances for instances of availability ranked above security. Adjust as needed, documenting justifications for each. Then map, document, and communicate practical action to step back services and systems.

12 months: Expect vulnerability discovery to keep accelerating as frontier models evolve. Get proactive in retiring what is no longer needed. ASD names legacy technology among the biggest risks, and it will become increasingly problematic.

Key Sources

This post is the full S³ Brief. A snapshot runs as a LinkedIn Newsletter. Subscribe to receive the full S³ Brief direct to your inbox. [subscribe here]

Working through complexity in your organisation? reach out [enquiry form]

Leanne Simpson

Author of S³ Brief and Founder of Critical Connections

Back to Blog